CVE-2026-74601

Status: UPDATED  |  Advisory ID: CVE-2026-74601

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Use current_context for safe per-CPU buffer swap

The ring_buffer_swap_cpu() function currently checks the per-CPU

committing counter to determine if a buffer is actively being written to

before performing the swap. However, there exists a race window where

this check can be bypassed:

ring_buffer_lock_reserve

cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a

rb_reserve_next_event

rb_start_commit // inc committing

if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}

__rb_reserve_next

rb_move_tail

rb_end_commit(cpu_buffer); // dec committing => 0

/* interrupt hits here, successfully swaps! */

local_inc(&cpu_buffer->committing);

ring_buffer_unlock_commit

cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b

rb_commit

rb_end_commit

RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))

// triggers warning

The committing counter can temporarily drop to 0 during a single write

operation (within rb_move_tail), creating a window where swap can

succeed even though the write is still in progress. This leads to

inconsistent buffer state and triggers the RB_WARN_ON in rb_commit().

Replace the committing counter check with current_context checks, which

are set at the entry of ring_buffer_lock_reserve() and remain valid

throughout the entire write operation, providing a reliable indicator of

buffer busy state during swap. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References